The Agent Skills Directory

[DATA_EXFILTRATION]: The SKILL.md file contains debugging examples for multi-component systems that involve sensitive system commands. Specifically, the 'Layer 3' and 'Layer 4' examples suggest using security list-keychains and security find-identity -v, which access information about macOS keychains and security certificates. Additionally, 'Layer 2' suggests using env | grep IDENTITY, which could expose sensitive environment variables.
[COMMAND_EXECUTION]: The skill includes a bash script find-polluter.sh designed to identify tests that create unwanted state. This script programmatically executes test files using npm test, which involves running arbitrary JavaScript code within the project context.
[PROMPT_INJECTION]: Several files (test-academic.md, test-pressure-1.md, test-pressure-2.md, and test-pressure-3.md) are included as evaluation tests. These files use imperative language (e.g., 'answer these questions based SOLELY on what the skill says', 'You must choose and act', 'Don't ask hypothetical questions') that mimics prompt injection techniques to test the agent's adherence to the skill's debugging methodology under pressure.
[PROMPT_INJECTION]: Indirect prompt injection surface exists as the skill instructs the agent to 'Read Error Messages Carefully' and trace data flows. Malicious error messages or logs could contain instructions that the agent might follow while performing its debugging task.
Ingestion points: Error messages, stack traces, log files, and git diff output analyzed in SKILL.md and root-cause-tracing.md.
Boundary markers: Absent. No instructions to use delimiters or sanitizers for external error data.
Capability inventory: Ability to execute shell commands (find-polluter.sh), run tests (npm test), and access system state (security).
Sanitization: None; the skill encourages trusting the content of error messages for solutions.
[DATA_EXFILTRATION]: The root-cause-tracing.md documentation suggests adding instrumentation that logs stack traces and environment variables (nodeEnv: process.env.NODE_ENV) to the console, which can lead to sensitive data exposure in log files.

systematic-debugging